A signed swap.
A service lead.

The collector signed this itself.

At October 29, 17:32:38 UTC, collector 0x3f9913…ffc18 executed its nonce-1 swap through Kyber on Polygon. Rebuilding the signed transaction recovers that same collector address. The receipt shows 514.704530 USDC.e leaving it: 513.417769 to the swap executor and 1.286761 to the fee address. Transaction ↗

The router’s Swapped event reports 5,528.218724811418008480 POL returned to the collector. That is the executed event amount; the client’s quoted output is different. This proof contains the transaction and receipt, without an internal native-transfer trace. Signature, amounts and event verification ↗

The fee address has a public service match.

The 1.286761 USDC.e fee went to 0xcd6b980029e6e6e0733ac8ec3e02be9410d09799. That exact address appears as DEBT_FEE_TARGET in Rabby’s official mobile source, including its Polygon configuration.

The source is a Lending / ParaSwap configuration. It establishes a configured service fee target, without establishing a Kyber-specific fee policy, legal ownership of the address or attacker control of it. Exact-address source match ↗

The useful lead is the route record.

The signed calldata and emitted client-data event contain the same Source: rabby and this RouteID:

28d6c9d39K9OdYNa:029a0ea0EG9MPrxi

Kyber’s current API documentation describes source as a caller-provided onchain tracking value, which can differ from x-client-id. It describes routeID as a unique route identifier. Signing these bytes binds the collector to the submitted metadata; it does not authenticate a Rabby customer, browser, device or login. The current schema also does not establish the precise backend used on October 29. Field meanings and source provenance ↗

A matching provider-side record, if retained, could corroborate which request produced the route. No such records have been accessed. The complete transaction and route lookup tuple is preserved.

We have accounts and keys. The person remains unknown.

The known selling account is gfg44433, deposit wallet 0x5a2764fbbe5d139ef0ed988ec5f95320ce730c0b, with owner/signer 0x0543635ef8e7981c4885fcfc187bc8564481ef74. These identify an account and key. The new swap proof identifies a collector signature and service lead. Neither establishes a real-world identity or a Car–attacker control link. Retained public profile ↗ · Deployment and owner records ↗ · Public attribution checks ↗

Follow the actual amounts.

The latest sampled state is unchanged.

The October 31 checks at 17:00:47 UTC on Ethereum and 17:00:54 on Polygon match all 30 selected state fields from 14:12. The selling account holds 4,939.424699 pUSD. This compares selected state at two snapshots; it does not rule out intervening activity. Snapshot comparison ↗ · Earlier 20 pUSD redemption ↗